Introducing Programmable Flow Protection: Custom DDoS Mitigation Logic for Magic Transit Customers

Cloudflare has unveiled Programmable Flow Protection. This feature allows Magic Transit customers to write their own eBPF logic and deploy it to Cloudflare's global network, enabling custom DDoS mitigation tailored to their own protocols. It is currently in beta, and is offered to Magic Transit Enterprise customers for an additional fee.

The core idea is that even if Cloudflare doesn't fully understand a custom, proprietary UDP-based protocol, customers can define their own criteria for what counts as a "good packet" and a "bad packet." The program can choose to either drop the packet or challenge it, and Cloudflare runs this across its entire network to block attack traffic before it reaches the origin.

Cloudflare has previously operated defense systems such as Advanced TCP Protection, Advanced DNS Protection, and protections for well-known protocols like NTP, RDP, and SIP. However, when the structure inside a UDP payload is unknown, the only options available were generic block or rate limit actions, which risked blocking legitimate traffic along with attacks, or being too loose or too aggressive depending on the customer.

This platform was built to reduce that limitation. Through helpers provided by Cloudflare, programs can perform tasks such as:

• Parsing packet structure, verifying memory safety, and performing conditional branching
• Storing source IP state to maintain stateful tracking
• Issuing and verifying cryptographic challenges
• Allowing verified clients through while blocking suspicious traffic

As an illustrative example, a game server operating on UDP port 207 is presented. The customer checks a specific token value in the application header to pass only legitimate traffic, then tracks state per source IP, issuing a challenge to verify whether the client is real in cases of replay or script-based attacks.

Ultimately, this feature combines the customer's domain knowledge with Cloudflare's global absorption capacity, enabling more precise UDP DDoS response than existing defense systems. Cloudflare emphasizes that this allows customers to directly define and deploy policies tailored to their own protocols even during large-scale attacks.